.net 防止sql注入-白红宇

.net 防止sql注入

阅读量：6608 次

发布时间：2019-06-24

本文共 5727 字，大约阅读时间需要 19 分钟。

public class SqlCheck

{
 public SqlCheck()
 {
 //
 // TODO: 在此处添加构造函数逻辑
 //
 }


 public SqlConnection oconn()
 {
 SqlConnection conn = new SqlConnection();
 conn.ConnectionString = ConfigurationManager.ConnectionStrings["StudyConnectionString"].ToString();
 //第1种调用的方法 JK1986_CheckSql();
 JK1986_CheckSql();
 if ( conn.State == ConnectionState.Closed )
 {
 conn.Open();
 }
 return conn;
 }

 public DataTable getsource(string getds)
 {
 SqlConnection conn = oconn();
 SqlDataAdapter da = new SqlDataAdapter(getds, conn);
 DataSet ds = new DataSet();
 da.Fill(ds,"news" );
 return ds.Tables["news"];
 }


 public static void JK1986_CheckSql()
 {
 string jk1986_sql = "exec↓select↓drop↓alter↓exists↓union↓and↓or↓xor↓order↓mid↓asc↓execute↓xp_cmdshell↓insert↓update↓delete↓join↓declare↓char↓sp_oacreate↓wscript.shell↓xp_regwrite↓'↓;↓--";
 string[] jk_sql = jk1986_sql.Split('↓');
 foreach (string jk in jk_sql)
 {
 // -----------------------防 Post 注入-----------------------
 if ( System.Web.HttpContext.Current.Request.Form != null)
 {
 for (int k = 0; k < System.Web.HttpContext.Current.Request.Form.Count; k++)
 {
 string getsqlkey = System.Web.HttpContext.Current.Request.Form.Keys[k];
 string getip;
 if (System.Web.HttpContext.Current.Request.Form[getsqlkey].ToLower().Contains(jk) == true)
 {
 System.Web.HttpContext.Current.Response.Write("<script Language=JavaScript>alert('ASP.NET( C#版本 )防注入程序提示您，请勿提交非法字符！↓\\n\\nBlog:http://hi.baidu.com/ahhacker86\\n\\nBy:aa && JK1986');</" + "script>");
 System.Web.HttpContext.Current.Response.Write("非法操作！系统做了如下记录 ↓" + " ");
 if (System.Web.HttpContext.Current.Request.ServerVariables["HTTP_X_FORWARDED_FOR"] != null)
 {
 getip = System.Web.HttpContext.Current.Request.ServerVariables["HTTP_X_FORWARDED_FOR"];
 }
 else
 {
 getip = System.Web.HttpContext.Current.Request.ServerVariables["REMOTE_ADDR"];
 }
 System.Web.HttpContext.Current.Response.Write("操作 I P ：" + getip + " ");
 System.Web.HttpContext.Current.Response.Write("操作时间：" + DateTime.Now.ToString() + " ");
 System.Web.HttpContext.Current.Response.Write("操作页面：" + System.Web.HttpContext.Current.Request.ServerVariables["URL"] + " ");
 System.Web.HttpContext.Current.Response.Write("提交方式：P O S T " + " ");
 System.Web.HttpContext.Current.Response.Write("提交参数：" + jk + " ");
 System.Web.HttpContext.Current.Response.Write("提交数据：" + System.Web.HttpContext.Current.Request.Form[getsqlkey].ToLower() + " ");
 System.Web.HttpContext.Current.Response.End();
 }
 }
 }
 // -----------------------防 GET 注入-----------------------
 if (System.Web.HttpContext.Current.Request.QueryString != null)
 {
 for (int k = 0; k < System.Web.HttpContext.Current.Request.QueryString.Count; k++)
 {
 string getsqlkey = System.Web.HttpContext.Current.Request.QueryString.Keys[k];
 string getip;
 if (System.Web.HttpContext.Current.Request.QueryString[getsqlkey].ToLower().Contains(jk) == true)
 {
 System.Web.HttpContext.Current.Response.Write("<script Language=JavaScript>alert('ASP.NET( C#版本 )防注入程序提示您，请勿提交非法字符！↓\\n\\nBlog:http://hi.baidu.com/ahhacker86\\n\\nBy:aa && JK1986');</" + "script>");
 System.Web.HttpContext.Current.Response.Write("非法操作！系统做了如下记录 ↓" + " ");
 if (System.Web.HttpContext.Current.Request.ServerVariables["HTTP_X_FORWARDED_FOR"] != null)
 {
 getip = System.Web.HttpContext.Current.Request.ServerVariables["HTTP_X_FORWARDED_FOR"];
 }
 else
 {
 getip = System.Web.HttpContext.Current.Request.ServerVariables["REMOTE_ADDR"];
 }
 System.Web.HttpContext.Current.Response.Write("操作 I P ：" + getip + " ");
 System.Web.HttpContext.Current.Response.Write("操作时间：" + DateTime.Now.ToString() + " ");
 System.Web.HttpContext.Current.Response.Write("操作页面：" + System.Web.HttpContext.Current.Request.ServerVariables["URL"] + " ");
 System.Web.HttpContext.Current.Response.Write("提交方式：G E T " + " ");
 System.Web.HttpContext.Current.Response.Write("提交参数：" + jk + " ");
 System.Web.HttpContext.Current.Response.Write("提交数据：" + System.Web.HttpContext.Current.Request.QueryString[getsqlkey].ToLower() + " ");
 System.Web.HttpContext.Current.Response.End();
 }
 }
 }

 // -----------------------防 Cookies 注入-----------------------
 if (System.Web.HttpContext.Current.Request.Cookies != null)
 {
 for (int k = 0; k < System.Web.HttpContext.Current.Request.Cookies.Count; k++)
 {
 string getsqlkey = System.Web.HttpContext.Current.Request.Cookies.Keys[k];
 string getip;
 if (System.Web.HttpContext.Current.Request.Cookies[getsqlkey].Value.ToLower().Contains(jk) == true)
 {
 System.Web.HttpContext.Current.Response.Write("<script Language=JavaScript>alert('ASP.NET( C#版本 )防注入程序提示您，请勿提交非法字符！↓\\n\\nBlog:http://hi.baidu.com/ahhacker86\\n\\nBy:aa && JK1986');</" + "script>");
 System.Web.HttpContext.Current.Response.Write("非法操作！系统做了如下记录 ↓" + " ");
 if (System.Web.HttpContext.Current.Request.ServerVariables["HTTP_X_FORWARDED_FOR"] != null)
 {
 getip = System.Web.HttpContext.Current.Request.ServerVariables["HTTP_X_FORWARDED_FOR"];
 }
 else
 {
 getip = System.Web.HttpContext.Current.Request.ServerVariables["REMOTE_ADDR"];
 }
 System.Web.HttpContext.Current.Response.Write("操作 I P ：" + getip + " ");
 System.Web.HttpContext.Current.Response.Write("操作时间：" + DateTime.Now.ToString() + " ");
 System.Web.HttpContext.Current.Response.Write("操作页面：" + System.Web.HttpContext.Current.Request.ServerVariables["URL"] + " ");
 System.Web.HttpContext.Current.Response.Write("提交方式： Cookies " + " ");
 System.Web.HttpContext.Current.Response.Write("提交参数：" + jk + " ");
 System.Web.HttpContext.Current.Response.Write("提交数据：" + System.Web.HttpContext.Current.Request.Cookies[getsqlkey].Value.ToLower() + " ");
 System.Web.HttpContext.Current.Response.End();
 }
 }
 }

 }
 }

}

来源于： B.B.S.T 信息安全团队 BadBoy网络安全小组

转载于:https://www.cnblogs.com/secbook/archive/2011/12/06/2654922.html

你可能感兴趣的文章

找到一个适合的分布式文件系统之各种分布式文件系统优缺点对比